Privacy Policy

1. Introduction

Afloral Flowers ("we," "us," or "our"), a business operating in Auckland, New Zealand, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and disclose your information when you visit our website or make a purchase.

We process personal data in accordance with the Privacy Act 2020 and other applicable New Zealand privacy and consumer laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

We collect the following categories of personal data:

• Identity data: first name, last name
• Contact data: email address, phone number, shipping and billing address
• Transaction data: order details, payment information (processed securely by Stripe; we do not store card numbers)
• Technical data: IP address, browser type, device information, pages visited, and cookies
• Communication data: messages you send us via contact forms, email, or WhatsApp
• Body measurement data: delivery preferences, gift messages, and custom bouquet requests

4. Legal Basis for Processing

We process your data on the following legal grounds:

• Performance of a contract: processing orders, shipping, and providing customer service
• Consent: sending marketing emails and newsletters (you may withdraw consent at any time)
• Legitimate interest: improving our website, preventing fraud, and understanding customer preferences
• Legal obligation: complying with tax, accounting, and regulatory requirements under New Zealand law

5. How We Use Your Data

We use your personal data to:

• Process and fulfill your flower orders and local deliveries
• Communicate with you about your order status
• Prepare custom bouquets, event flowers, and gift messages
• Send marketing communications (with your consent)
• Improve our website, products, and services
• Comply with legal and regulatory obligations
• Prevent fraudulent transactions

6. Data Sharing and Transfers

We may share your personal data with the following third parties, solely to the extent necessary to provide our services:

• Payment processors: Stripe, for secure payment handling
• Shipping providers: to deliver your orders
• Hosting providers: Vercel and Railway, for website and backend infrastructure
• Analytics services: to understand website usage (anonymized where possible)

Where data is transferred outside of New Zealand, we ensure appropriate safeguards are in place through our service-provider agreements and operational controls.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Order and transaction data: 6 years (as required by New Zealand tax and accounting requirements)
• Account data: until you request deletion
• Marketing preferences: until you withdraw consent
• Custom request and gift-message data: as long as needed to complete your order and support service history

8. Your Rights

Subject to applicable New Zealand privacy law, you may request access to or correction of your personal data:

• Right of access: obtain confirmation of whether your data is being processed and receive a copy
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data where no longer necessary
• Right to restrict processing: limit how we use your data in certain circumstances
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at afloralflowernz@gmail.com. We will respond within 30 days.

9. Cookies

Our website uses cookies and similar technologies to enhance your browsing experience:

• Essential cookies: required for the website to function (cart, session, language preference)
• Analytics cookies: help us understand how visitors use our site

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All payment transactions are encrypted via SSL/TLS and processed through PCI-DSS compliant services.

11. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

13. Contact Us

For any questions about this Privacy Policy or your personal data, please contact us: